renamed to main.go

main.go

@@ -0,0 +1,215 @@
+// Copyright 2017 github.com/DirkDuesentrieb
+// license that can be found in the LICENSE file.
+
+// a converter for FortiGate session logs to pcap files
+package main
+
+import (
+ "bufio"
+ "encoding/hex"
+ "fmt"
+ "io/ioutil"
+ "os"
+ "regexp"
+ "strconv"
+ "strings"
+ "time"
+)
+
+const (
+ globalHeader string = "d4c3b2a1020004000000000000000000ee05000001000000"
+ info string = `fgsniffer [-fixvpn]
+ Convert text captures to pcap files. 
+ On the fortigate run
+ diagnose sniffer packet <interface> '<filter>' <3|6> <count> a
+ to create a parsable dump.
+ -fixvpn adds virtual MAC addresses to avoid unparsable dumps on VPN/tunnel interfaces.`
+ unsafe string = "[]{}/\\*"
+)
+
+type (
+ pcaps struct {
+ pcap map[string]int
+ }
+ packet struct {
+ data string // raw hex data
+ size int64
+ secs, ms int64 // the packets timestamp
+ port string // the network port (verbose=6)
+ }
+)
+
+var fixvpn bool
+
+func main() {
+ var scanner *bufio.Scanner
+ var p packet
+ now := time.Now()
+ fname := os.Args[1]
+ if len(os.Args) > 1 {
+
+ switch os.Args[1] {
+ case "-?", "-h":
+ fmt.Println(info)
+ os.Exit(0)
+ case "-fixvpn":
+ fixvpn = true
+ fname = os.Args[2]
+ fallthrough
+ default:
+ f, err := os.Open(fname)
+ if err != nil {
+ fmt.Fprintln(os.Stderr, err)
+ os.Exit(1)
+ }
+ scanner = bufio.NewScanner(f)
+ }
+ } else {
+ scanner = bufio.NewScanner(os.Stdin)
+ }
+ hexLine := regexp.MustCompile("^0x([0-9a-f]+)[ |\t]+(.*$)")
+ // absolute time
+ headLineA := regexp.MustCompile("^([0-9-]+ [0-9][0-9]:[0-9][0-9]:[0-9][0-9])\\.([0-9]+) .*$")
+ // relative time
+ headLineR := regexp.MustCompile("^([0-9]+)\\.([0-9]+) .*$")
+ // verbose mode 6
+ headLine6 := regexp.MustCompile("\\.[0-9]+ ([^ ]+) (in|out|--) ")
+
+ pcps := pcaps{make(map[string]int)}
+
+ for scanner.Scan() {
+ date := ""
+ mseconds := ""
+ iface := ""
+ match := false
+ line := scanner.Text()
+ hexData := hexLine.FindStringSubmatch(line)
+
+ // packet header with absolute time
+ header := headLineA.FindStringSubmatch(line)
+ if len(header) == 3 {
+ match = true
+ date = header[1]
+ mseconds = header[2]
+ }
+ // packet header with relative time
+ header = headLineR.FindStringSubmatch(line)
+ if len(header) == 3 {
+ match = true
+ sec, err := time.ParseDuration(header[1] + "s")
+ if err != nil {
+ fmt.Println("time.ParseDuration("+header[1]+")", err)
+ }
+ date = now.Add(sec).In(time.UTC).Format("2006-01-02 15:04:05")
+ mseconds = header[2]
+ }
+ // verbose mode 6
+ header = headLine6.FindStringSubmatch(line)
+ if match && len(header) == 3 {
+ iface = header[1]
+ }
+ if match {
+ pcps.addPacket(p)
+ p = newPacket(date, mseconds, iface)
+ if fixvpn {
+ p.addData("00090f09010100090f0902020800")
+ }
+ }
+
+ // packet hex data
+ if len(hexData) == 3 {
+ p.addData(strings.Replace(hexData[2][:39], " ", "", -1))
+ }
+ }
+ if err := scanner.Err(); err != nil {
+ fmt.Fprintln(os.Stderr, err)
+ return
+ }
+ // clean up
+ pcps.addPacket(p)
+ for name, packets := range pcps.pcap {
+ fmt.Println("created output file", name, "with", packets, "packets.")
+ }
+}
+
+// create file, add global header
+func (pcps *pcaps) newPcap(name string) (err error) {
+ err = ioutil.WriteFile(name, nil, 0644)
+ if err != nil {
+ fmt.Println(err)
+ }
+ err = appendStringToFile(name, globalHeader)
+ if err != nil {
+ fmt.Println(err)
+ }
+ return err
+}
+
+// create a new packet. We need some data from the header
+func newPacket(date, mseconds, iface string) packet {
+ t, _ := time.Parse("2006-01-02 15:04:05", date)
+ ms, _ := strconv.ParseInt(mseconds, 10, 64)
+ return packet{"", 0, t.Unix(), ms, iface}
+}
+
+// add a data line to the packet
+func (p *packet) addData(data string) {
+ p.size += int64(len(data) / 2)
+ p.data += data
+}
+
+// all hex lines complete, write the packet to the pcap
+func (pcps *pcaps) addPacket(p packet) {
+ if p.size == 0 {
+ return
+ }
+ fname := "fgsniffer"
+ if p.port != "" {
+ for i := 0; i < len(unsafe); i++ {
+ p.port = strings.Replace(p.port, string(unsafe[i]), "_", -1)
+ }
+ fname += "-" + p.port
+ }
+ fname += ".pcap"
+ _, found := pcps.pcap[fname]
+ if !found {
+ pcps.pcap[fname] = 0
+ _ = pcps.newPcap(fname)
+ }
+ header := switchEndian(p.secs) + switchEndian(p.ms) + switchEndian(p.size) + switchEndian(p.size)
+ err := appendStringToFile(fname, header+p.data)
+ if err != nil {
+ fmt.Println(err)
+ }
+ pcps.pcap[fname]++
+}
+
+// 11259375 -> 00abcdef -> efcdab00
+func switchEndian(n int64) (r string) {
+ b := fmt.Sprintf("%08x", n)
+ for i := 0; i < 4; i++ {
+ start := 6 - 2*i
+ r = r + b[start:start+2]
+ }
+ return
+}
+
+// convert the hex data in string to binary and write it to file
+func appendStringToFile(file, text string) error {
+ f, err := os.OpenFile(file, os.O_APPEND|os.O_WRONLY, os.ModeAppend)
+ if err != nil {
+ return err
+ }
+ defer f.Close()
+ src := []byte(text)
+ dst := make([]byte, hex.DecodedLen(len(src)))
+ _, err = hex.Decode(dst, src)
+ if err != nil {
+ return err
+ }
+ _, err = f.Write(dst)
+ if err != nil {
+ return err
+ }
+ return nil
+}